@adatechnology/keycloak-admin 0.1.16 → 1.0.0-rc.1

package/dist/index.js

@@ -1,702 +1,335 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+// src/keycloak-admin.constant.ts
+var KEYCLOAK_ADMIN_GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials";
+var KEYCLOAK_ADMIN_FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+var KEYCLOAK_ADMIN_JSON_CONTENT_TYPE = "application/json";
+var KEYCLOAK_ADMIN_REDACTED = "[REDACTED]";
+var KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS = 3e4;
+var KEYCLOAK_ADMIN_ERROR_CODE = {
+  CONFIGURATION_INVALID: "KEYCLOAK_ADMIN_CONFIGURATION_INVALID",
+  REQUEST_FAILED: "KEYCLOAK_ADMIN_REQUEST_FAILED",
+  TOKEN_REQUEST_FAILED: "KEYCLOAK_ADMIN_TOKEN_REQUEST_FAILED",
+  TOKEN_RESPONSE_INVALID: "KEYCLOAK_ADMIN_TOKEN_RESPONSE_INVALID",
+  USER_ALREADY_EXISTS: "KEYCLOAK_ADMIN_USER_ALREADY_EXISTS",
+  USER_ID_MISSING: "KEYCLOAK_ADMIN_USER_ID_MISSING",
+  USER_NOT_FOUND: "KEYCLOAK_ADMIN_USER_NOT_FOUND"
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  KEYCLOAK_ADMIN_CLIENT: () => KEYCLOAK_ADMIN_CLIENT,
-  KEYCLOAK_ADMIN_CONFIG: () => KEYCLOAK_ADMIN_CONFIG,
-  KEYCLOAK_ADMIN_PROVIDER: () => KEYCLOAK_ADMIN_PROVIDER,
-  KeycloakAdminClient: () => KeycloakAdminClient,
-  KeycloakAdminError: () => KeycloakAdminError,
-  KeycloakAdminModule: () => KeycloakAdminModule,
-  validateKeycloakAdminConfig: () => validateKeycloakAdminConfig
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/keycloak-admin.module.ts
-var import_common2 = require("@nestjs/common");
-var import_http_client2 = require("@adatechnology/http-client");
-
-// src/keycloak-admin.token.ts
-var KEYCLOAK_ADMIN_CLIENT = "KEYCLOAK_ADMIN_CLIENT";
-var KEYCLOAK_ADMIN_CONFIG = "KEYCLOAK_ADMIN_CONFIG";
-var KEYCLOAK_ADMIN_PROVIDER = "KEYCLOAK_ADMIN_PROVIDER";
-
-// src/keycloak-admin.client.ts
-var import_common = require("@nestjs/common");
-var import_http_client = require("@adatechnology/http-client");
-var import_logger = require("@adatechnology/logger");
+function buildKeycloakAdminEndpoints({ baseUrl, realm }) {
+  const origin = baseUrl.replace(/\/+$/, "");
+  const encodedRealm = encodeURIComponent(realm);
+  const users = `${origin}/admin/realms/${encodedRealm}/users`;
+  return {
+    token: `${origin}/realms/${encodedRealm}/protocol/openid-connect/token`,
+    user: (userId) => `${users}/${encodeURIComponent(userId)}`,
+    userPassword: (userId) => `${users}/${encodeURIComponent(userId)}/reset-password`,
+    users
+  };
+}
 
-// src/errors/keycloak-admin.error.ts
-var _KeycloakAdminError = class _KeycloakAdminError extends Error {
-  statusCode;
+// src/keycloak-admin.error.ts
+var KeycloakAdminError = class _KeycloakAdminError extends Error {
   code;
   context;
-  constructor(params) {
-    super(params.message);
+  status;
+  constructor({ code, context = {}, message, status }) {
+    super(message);
     this.name = "KeycloakAdminError";
-    this.statusCode = params.statusCode;
-    this.code = params.code;
-    this.context = params.context;
+    this.code = code;
+    this.context = context;
+    this.status = status;
     Object.setPrototypeOf(this, _KeycloakAdminError.prototype);
   }
-};
-__name(_KeycloakAdminError, "KeycloakAdminError");
-var KeycloakAdminError = _KeycloakAdminError;
-
-// package.json
-var package_default = {
-  name: "@adatechnology/keycloak-admin",
-  version: "0.1.16",
-  publishConfig: {
-    access: "public"
-  },
-  main: "dist/index.js",
-  module: "dist/index.mjs",
-  types: "dist/index.d.ts",
-  files: [
-    "dist"
-  ],
-  scripts: {
-    build: "rm -rf dist && tsup && cp index.d.ts dist/index.d.ts",
-    "build:watch": "tsup --watch",
-    check: "tsc -p tsconfig.json --noEmit"
-  },
-  dependencies: {
-    "@adatechnology/http-client": "workspace:*",
-    "@adatechnology/logger": "workspace:*"
-  },
-  peerDependencies: {
-    "@nestjs/common": "^11.0.16",
-    "@nestjs/core": "^11"
-  },
-  devDependencies: {
-    "@adatechnology/shared": "workspace:*",
-    "@esbuild-plugins/tsconfig-paths": "^0.1.2",
-    "@swc/core": "^1.15.24",
-    tsup: "^8.5.1",
-    typescript: "^5.2.0"
+  toJSON() {
+    return {
+      code: this.code,
+      context: this.context,
+      message: this.message,
+      name: this.name,
+      status: this.status
+    };
   }
 };
+function isKeycloakAdminError(value) {
+  return value instanceof KeycloakAdminError;
+}
 
-// src/constants/keycloak-admin.constants.ts
-var KEYCLOAK_ADMIN_LIB_NAME = package_default.name;
-var KEYCLOAK_ADMIN_LIB_VERSION = package_default.version;
-var KEYCLOAK_ADMIN_GRANT_TYPE_PASSWORD = "password";
-var KEYCLOAK_ADMIN_CLIENT_ID_ADMIN_CLI = "admin-cli";
-var KEYCLOAK_ADMIN_CONTENT_TYPE_FORM = "application/x-www-form-urlencoded";
-var KEYCLOAK_ADMIN_CONTENT_TYPE_JSON = "application/json";
-var KEYCLOAK_ADMIN_AUTHORIZATION_HEADER = "Authorization";
-var KEYCLOAK_ADMIN_BEARER_PREFIX = "Bearer ";
-var KEYCLOAK_ADMIN_ENDPOINTS = {
-  MASTER_TOKEN: "/realms/master/protocol/openid-connect/token",
-  ADMIN_USERS: /* @__PURE__ */ __name((baseUrl, realm, userId) => userId ? `${baseUrl}/admin/realms/${realm}/users/${userId}` : `${baseUrl}/admin/realms/${realm}/users`, "ADMIN_USERS"),
-  ADMIN_RESET_PASSWORD: /* @__PURE__ */ __name((baseUrl, realm, userId) => `${baseUrl}/admin/realms/${realm}/users/${userId}/reset-password`, "ADMIN_RESET_PASSWORD"),
-  ADMIN_SEND_VERIFY_EMAIL: /* @__PURE__ */ __name((baseUrl, realm, userId) => `${baseUrl}/admin/realms/${realm}/users/${userId}/send-verify-email`, "ADMIN_SEND_VERIFY_EMAIL")
-};
-var KEYCLOAK_ADMIN_ERROR_CODES = {
-  ADMIN_TOKEN_ERROR: "KEYCLOAK_ADMIN_TOKEN_ERROR",
-  CREATE_USER_ERROR: "KEYCLOAK_CREATE_USER_ERROR",
-  UPDATE_USER_ERROR: "KEYCLOAK_UPDATE_USER_ERROR",
-  RESET_PASSWORD_ERROR: "KEYCLOAK_RESET_PASSWORD_ERROR",
-  TOGGLE_ENABLED_ERROR: "KEYCLOAK_TOGGLE_ENABLED_ERROR",
-  DELETE_USER_ERROR: "KEYCLOAK_DELETE_USER_ERROR",
-  UPDATE_ATTRIBUTES_ERROR: "KEYCLOAK_UPDATE_ATTRIBUTES_ERROR",
-  SEND_VERIFY_EMAIL_ERROR: "KEYCLOAK_SEND_VERIFY_EMAIL_ERROR"
-};
-
-// src/utils/extract-http-error.ts
-function extractHttpError(err) {
-  const unknownErr = err;
-  const response = unknownErr == null ? void 0 : unknownErr.response;
-  const responseData = response == null ? void 0 : response.data;
-  let statusCode = void 0;
-  if (typeof (unknownErr == null ? void 0 : unknownErr.status) === "number") {
-    statusCode = unknownErr.status;
-  } else if (typeof (response == null ? void 0 : response.status) === "number") {
-    statusCode = response.status;
+// src/keycloak-admin.schema.ts
+import { z } from "zod";
+function isAbsoluteHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
   }
-  const details = responseData ?? (unknownErr == null ? void 0 : unknownErr.message);
-  const rawError = (responseData == null ? void 0 : responseData.error) ?? (responseData == null ? void 0 : responseData.errorMessage);
-  const errorCode = typeof rawError === "string" ? rawError : typeof (unknownErr == null ? void 0 : unknownErr.code) === "string" ? unknownErr.code : void 0;
-  return {
-    statusCode,
-    details,
-    errorCode
-  };
 }
-__name(extractHttpError, "extractHttpError");
+var keycloakAdminConfigSchema = z.object({
+  baseUrl: z.string().min(1).refine(isAbsoluteHttpUrl, { message: "must be an absolute http(s) URL" }),
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1),
+  realm: z.string().min(1)
+});
+function parseKeycloakAdminConfig(value) {
+  const parsed = keycloakAdminConfigSchema.safeParse(value);
+  if (parsed.success) return parsed.data;
+  throw new KeycloakAdminError({
+    code: KEYCLOAK_ADMIN_ERROR_CODE.CONFIGURATION_INVALID,
+    context: { fields: parsed.error.issues.map((issue) => issue.path.join(".")).sort() },
+    message: "Invalid Keycloak admin configuration"
+  });
+}
 
-// src/keycloak-admin.client.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
+// src/keycloak-admin.redaction.ts
+function replaceAll({ secrets, text }) {
+  return secrets.reduce((current, secret) => current.split(secret).join(KEYCLOAK_ADMIN_REDACTED), text);
 }
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+function redactDeep({ secrets, value }) {
+  if (typeof value === "string") return replaceAll({ secrets, text: value });
+  if (Array.isArray(value)) return value.map((item) => redactDeep({ secrets, value: item }));
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactDeep({ secrets, value: item })]));
+  }
+  return value;
 }
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
+function createSecretRedactor(...secrets) {
+  const known = secrets.filter((secret) => typeof secret === "string" && secret !== "");
+  return {
+    text(value) {
+      return replaceAll({ secrets: known, text: value });
+    },
+    value(value) {
+      return redactDeep({ secrets: known, value });
+    },
+    with(...additional) {
+      return createSecretRedactor(...known, ...additional);
+    }
   };
 }
-__name(_ts_param, "_ts_param");
-var _KeycloakAdminClient = class _KeycloakAdminClient {
-  config;
-  httpProvider;
-  logger;
-  className = this.constructor.name;
-  constructor(config, httpProvider, logger) {
-    this.config = config;
-    this.httpProvider = httpProvider;
-    this.logger = logger;
+
+// src/keycloak-admin.response.ts
+var MAX_DETAIL_LENGTH = 200;
+async function readKeycloakDetail(response) {
+  const text = await response.text().catch(() => "");
+  if (text === "") return void 0;
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object") return text.slice(0, MAX_DETAIL_LENGTH);
+    const payload = parsed;
+    const detail = payload.errorMessage ?? payload.error_description ?? payload.error;
+    return typeof detail === "string" ? detail.slice(0, MAX_DETAIL_LENGTH) : void 0;
+  } catch {
+    return text.slice(0, MAX_DETAIL_LENGTH);
   }
-  log(level, message, libMethod, meta) {
-    if (!this.logger) return;
-    const payload = {
-      message,
-      context: this.className,
-      lib: KEYCLOAK_ADMIN_LIB_NAME,
-      libVersion: KEYCLOAK_ADMIN_LIB_VERSION,
-      libMethod,
-      meta
-    };
-    if (level === "info") this.logger.info(payload);
-    else if (level === "warn") this.logger.warn(payload);
-    else if (level === "error") this.logger.error(payload);
+}
+
+// src/keycloak-admin.token.ts
+function createKeycloakTokenProvider({
+  config,
+  endpoint,
+  fetch: fetchImpl,
+  now,
+  redactor
+}) {
+  let cached;
+  let inFlight;
+  function isFresh(state) {
+    return state.expiresAtMs - KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS > now();
   }
-  async getAdminToken() {
-    const method = "getAdminToken";
-    this.log("info", `${method} - Start`, method, {
-      realm: this.config.realm
+  async function requestToken() {
+    const requestedAtMs = now();
+    const response = await fetchImpl(endpoint, {
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        grant_type: KEYCLOAK_ADMIN_GRANT_TYPE_CLIENT_CREDENTIALS
+      }),
+      headers: { "content-type": KEYCLOAK_ADMIN_FORM_CONTENT_TYPE },
+      method: "POST"
     });
-    const url = `${this.config.baseUrl}${KEYCLOAK_ADMIN_ENDPOINTS.MASTER_TOKEN}`;
-    const body = new URLSearchParams();
-    body.append("grant_type", KEYCLOAK_ADMIN_GRANT_TYPE_PASSWORD);
-    body.append("client_id", KEYCLOAK_ADMIN_CLIENT_ID_ADMIN_CLI);
-    body.append("username", this.config.adminUser);
-    body.append("password", this.config.adminPassword);
-    try {
-      const response = await this.httpProvider.post({
-        url,
-        data: body,
-        config: {
-          headers: {
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_FORM
-          }
-        }
-      });
-      const result = {
-        accessToken: response.data.access_token,
-        expiresIn: response.data.expires_in,
-        tokenType: response.data.token_type
-      };
-      this.log("info", `${method} - Success`, method);
-      return result;
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        statusCode,
-        errorCode
-      });
+    if (!response.ok) {
       throw new KeycloakAdminError({
-        message: "Keycloak admin token request failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.ADMIN_TOKEN_ERROR,
-        context: {
-          url,
-          method: "POST",
-          details,
-          errorCode
-        }
+        code: KEYCLOAK_ADMIN_ERROR_CODE.TOKEN_REQUEST_FAILED,
+        context: redactor.value({ detail: await readKeycloakDetail(response), realm: config.realm }),
+        message: "Keycloak refused the service account token request",
+        status: response.status
       });
     }
-  }
-  async createUser(params) {
-    var _a, _b;
-    const method = "createUser";
-    const { username, email, firstName, lastName, enabled, emailVerified, credentials, attributes, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      username,
-      email
-    });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm);
-    const userData = {
-      username,
-      email,
-      firstName,
-      lastName,
-      enabled,
-      emailVerified,
-      ...credentials ? {
-        credentials
-      } : {},
-      ...attributes ? {
-        attributes
-      } : {}
-    };
-    try {
-      const response = await this.httpProvider.post({
-        url,
-        data: userData,
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      const locationHeader = ((_a = response.headers) == null ? void 0 : _a["location"]) ?? ((_b = response.headers) == null ? void 0 : _b["Location"]);
-      const userId = typeof locationHeader === "string" ? locationHeader.split("/").pop() ?? "" : "";
-      this.log("info", `${method} - Success`, method, {
-        username,
-        email,
-        userId
-      });
-      return userId;
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        username,
-        email,
-        statusCode,
-        errorCode
-      });
+    const payload = await response.json();
+    if (typeof payload.access_token !== "string" || typeof payload.expires_in !== "number") {
       throw new KeycloakAdminError({
-        message: "Keycloak create user failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.CREATE_USER_ERROR,
-        context: {
-          url,
-          method: "POST",
-          username,
-          email,
-          details,
-          errorCode
-        }
+        code: KEYCLOAK_ADMIN_ERROR_CODE.TOKEN_RESPONSE_INVALID,
+        context: { realm: config.realm },
+        message: "Keycloak returned a token response without access_token or expires_in",
+        status: response.status
       });
     }
+    return {
+      accessToken: payload.access_token,
+      expiresAtMs: requestedAtMs + payload.expires_in * 1e3
+    };
   }
-  async updateUser(params) {
-    const method = "updateUser";
-    const { userId, userData, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId
-    });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: userData,
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak update user failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.UPDATE_USER_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
-      });
+  return {
+    async getAccessToken() {
+      if (cached && isFresh(cached)) return cached.accessToken;
+      inFlight ??= requestToken();
+      try {
+        const state = await inFlight;
+        cached = state;
+        return state.accessToken;
+      } finally {
+        inFlight = void 0;
+      }
     }
-  }
-  async resetPassword(params) {
-    const method = "resetPassword";
-    const { userId, password, temporary, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId,
-      temporary
+  };
+}
+
+// src/keycloak-admin.client.ts
+var HTTP_CONFLICT = 409;
+var HTTP_NOT_FOUND = 404;
+function errorCodeOf(status) {
+  if (status === HTTP_NOT_FOUND) return KEYCLOAK_ADMIN_ERROR_CODE.USER_NOT_FOUND;
+  if (status === HTTP_CONFLICT) return KEYCLOAK_ADMIN_ERROR_CODE.USER_ALREADY_EXISTS;
+  return KEYCLOAK_ADMIN_ERROR_CODE.REQUEST_FAILED;
+}
+function normalizeAttributes(attributes) {
+  return Object.fromEntries(
+    Object.entries(attributes).map(([key, value]) => [key, typeof value === "string" ? [value] : [...value]])
+  );
+}
+function userIdFromLocation(response) {
+  const location = response.headers.get("location");
+  const id = location?.split("/").filter(Boolean).at(-1);
+  if (id === void 0 || id === "") {
+    throw new KeycloakAdminError({
+      code: KEYCLOAK_ADMIN_ERROR_CODE.USER_ID_MISSING,
+      message: "Keycloak created the user without a usable Location header",
+      status: response.status
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_RESET_PASSWORD(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {
-          type: "password",
-          value: password,
-          temporary
-        },
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak reset password failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.RESET_PASSWORD_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
-      });
-    }
   }
-  async toggleUserEnabled(params) {
-    const method = "toggleUserEnabled";
-    const { userId, enabled, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId,
-      enabled
+  return id;
+}
+function createKeycloakAdminClient({
+  config: rawConfig,
+  fetch: injectedFetch,
+  now = Date.now
+}) {
+  const config = parseKeycloakAdminConfig(rawConfig);
+  const endpoints = buildKeycloakAdminEndpoints(config);
+  const redactor = createSecretRedactor(config.clientSecret);
+  const fetchImpl = injectedFetch ?? ((input, init) => globalThis.fetch(input, init));
+  const tokenProvider = createKeycloakTokenProvider({
+    config,
+    endpoint: endpoints.token,
+    fetch: fetchImpl,
+    now,
+    redactor
+  });
+  async function adminRequest({ body, method, secrets = [], url }) {
+    const accessToken = await tokenProvider.getAccessToken();
+    const response = await fetchImpl(url, {
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      headers: {
+        authorization: `Bearer ${accessToken}`,
+        ...body === void 0 ? {} : { "content-type": KEYCLOAK_ADMIN_JSON_CONTENT_TYPE }
+      },
+      method
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {
-          enabled
-        },
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId,
-        enabled
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        enabled,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak toggle user enabled failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.TOGGLE_ENABLED_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          enabled,
-          details,
-          errorCode
-        }
-      });
-    }
-  }
-  async deleteUser(params) {
-    const method = "deleteUser";
-    const { userId, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId
+    if (response.ok) return response;
+    const callRedactor = redactor.with(accessToken, ...secrets);
+    throw new KeycloakAdminError({
+      code: errorCodeOf(response.status),
+      context: callRedactor.value({
+        detail: await readKeycloakDetail(response),
+        method,
+        realm: config.realm
+      }),
+      message: callRedactor.text(`Keycloak admin request failed with status ${response.status}`),
+      status: response.status
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.delete({
-        url,
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak delete user failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.DELETE_USER_ERROR,
-        context: {
-          url,
-          method: "DELETE",
-          userId,
-          details,
-          errorCode
-        }
-      });
-    }
   }
-  async updateUserAttributes(params) {
-    const method = "updateUserAttributes";
-    const { userId, attributes, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId,
-      attributeKeys: Object.keys(attributes)
+  async function setPassword({ password, temporary, userId }) {
+    await adminRequest({
+      body: { temporary, type: "password", value: password },
+      method: "PUT",
+      secrets: [password],
+      url: endpoints.userPassword(userId)
     });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_USERS(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {
-          attributes
-        },
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
-      });
-      throw new KeycloakAdminError({
-        message: "Keycloak update user attributes failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.UPDATE_ATTRIBUTES_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
-      });
-    }
   }
-  async sendVerifyEmail(params) {
-    const method = "sendVerifyEmail";
-    const { userId, adminToken } = params;
-    this.log("info", `${method} - Start`, method, {
-      userId
-    });
-    const url = KEYCLOAK_ADMIN_ENDPOINTS.ADMIN_SEND_VERIFY_EMAIL(this.config.baseUrl, this.config.realm, userId);
-    try {
-      await this.httpProvider.put({
-        url,
-        data: {},
-        config: {
-          headers: {
-            [KEYCLOAK_ADMIN_AUTHORIZATION_HEADER]: `${KEYCLOAK_ADMIN_BEARER_PREFIX}${adminToken}`,
-            "Content-Type": KEYCLOAK_ADMIN_CONTENT_TYPE_JSON
-          }
-        }
-      });
-      this.log("info", `${method} - Success`, method, {
-        userId
-      });
-    } catch (err) {
-      const { statusCode, details, errorCode } = extractHttpError(err);
-      this.log("error", `${method} - Failed`, method, {
-        userId,
-        statusCode,
-        errorCode
+  return {
+    async createUser({
+      attributes,
+      email,
+      emailVerified,
+      enabled,
+      firstName,
+      lastName,
+      password,
+      username
+    }) {
+      const response = await adminRequest({
+        body: {
+          ...attributes === void 0 ? {} : { attributes: normalizeAttributes(attributes) },
+          ...password === void 0 ? {} : {
+            credentials: [{ temporary: password.temporary, type: "password", value: password.value }]
+          },
+          email,
+          emailVerified: emailVerified ?? false,
+          enabled: enabled ?? true,
+          firstName,
+          lastName,
+          username
+        },
+        method: "POST",
+        secrets: [password?.value],
+        url: endpoints.users
       });
-      throw new KeycloakAdminError({
-        message: "Keycloak send verify email failed",
-        statusCode: statusCode ?? 502,
-        code: KEYCLOAK_ADMIN_ERROR_CODES.SEND_VERIFY_EMAIL_ERROR,
-        context: {
-          url,
-          method: "PUT",
-          userId,
-          details,
-          errorCode
-        }
+      return { id: userIdFromLocation(response) };
+    },
+    async deleteUser({ userId }) {
+      await adminRequest({ method: "DELETE", url: endpoints.user(userId) });
+    },
+    async findUserByEmail({ email }) {
+      const query = new URLSearchParams({ email, exact: "true" });
+      const response = await adminRequest({ method: "GET", url: `${endpoints.users}?${query}` });
+      const found = await response.json();
+      return found.at(0);
+    },
+    /**
+     * Pede um a mais que o limite para saber se há próxima página sem uma segunda chamada — o
+     * Keycloak não devolve total, e contar o realm inteiro só para desenhar um botão é caro.
+     */
+    async listUsers({ first = 0, limit = 100, search } = {}) {
+      const query = new URLSearchParams({ first: String(first), max: String(limit + 1) });
+      if (search !== void 0 && search !== "") query.set("search", search);
+      const response = await adminRequest({ method: "GET", url: `${endpoints.users}?${query}` });
+      const found = await response.json();
+      return { hasMore: found.length > limit, users: found.slice(0, limit) };
+    },
+    async setEnabled({ enabled, userId }) {
+      await adminRequest({ body: { enabled }, method: "PUT", url: endpoints.user(userId) });
+    },
+    setPassword,
+    async setTemporaryPassword({ password, userId }) {
+      await setPassword({ password, temporary: true, userId });
+    },
+    async updateAttributes({ attributes, userId }) {
+      await adminRequest({
+        body: { attributes: normalizeAttributes(attributes) },
+        method: "PUT",
+        url: endpoints.user(userId)
       });
+    },
+    async updateUser({ user, userId }) {
+      await adminRequest({ body: user, method: "PUT", url: endpoints.user(userId) });
     }
-  }
-};
-__name(_KeycloakAdminClient, "KeycloakAdminClient");
-var KeycloakAdminClient = _KeycloakAdminClient;
-KeycloakAdminClient = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Inject)(KEYCLOAK_ADMIN_CONFIG)),
-  _ts_param(1, (0, import_common.Inject)(import_http_client.HTTP_PROVIDER)),
-  _ts_param(2, (0, import_common.Optional)()),
-  _ts_param(2, (0, import_common.Inject)(import_logger.LOGGER_PROVIDER)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof KeycloakAdminConfig === "undefined" ? Object : KeycloakAdminConfig,
-    typeof HttpProviderInterface === "undefined" ? Object : HttpProviderInterface,
-    typeof LoggerProviderInterface === "undefined" ? Object : LoggerProviderInterface
-  ])
-], KeycloakAdminClient);
-
-// src/utils/validate-config.ts
-function validateKeycloakAdminConfig(config) {
-  const issues = [];
-  if (!config) {
-    throw new KeycloakAdminError({
-      message: "KeycloakAdminConfig is required. Provide an object with baseUrl, realm, adminUser and adminPassword.",
-      statusCode: 400,
-      code: "KEYCLOAK_ADMIN_CONFIG_MISSING"
-    });
-  }
-  if (typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") {
-    issues.push({
-      field: "baseUrl",
-      message: "baseUrl is required and must be a non-empty string (e.g. 'http://localhost:8081')"
-    });
-  } else if (!config.baseUrl.startsWith("http://") && !config.baseUrl.startsWith("https://")) {
-    issues.push({
-      field: "baseUrl",
-      message: `baseUrl must start with 'http://' or 'https://'. Received: '${config.baseUrl}'`
-    });
-  }
-  if (typeof config.realm !== "string" || config.realm.trim() === "") {
-    issues.push({
-      field: "realm",
-      message: "realm is required and must be a non-empty string (e.g. 'BACKEND')"
-    });
-  }
-  if (typeof config.adminUser !== "string" || config.adminUser.trim() === "") {
-    issues.push({
-      field: "adminUser",
-      message: "adminUser is required and must be a non-empty string"
-    });
-  }
-  if (typeof config.adminPassword !== "string" || config.adminPassword.trim() === "") {
-    issues.push({
-      field: "adminPassword",
-      message: "adminPassword is required and must be a non-empty string"
-    });
-  }
-  if (issues.length > 0) {
-    const summary = issues.map((i) => `  - ${i.field}: ${i.message}`).join("\n");
-    throw new KeycloakAdminError({
-      message: `KeycloakAdminConfig validation failed:
-${summary}`,
-      statusCode: 400,
-      code: "KEYCLOAK_ADMIN_CONFIG_INVALID",
-      context: {
-        issues
-      }
-    });
-  }
-}
-__name(validateKeycloakAdminConfig, "validateKeycloakAdminConfig");
-
-// src/keycloak-admin.module.ts
-function _ts_decorate2(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
+  };
 }
-__name(_ts_decorate2, "_ts_decorate");
-var _KeycloakAdminModule = class _KeycloakAdminModule {
-  static forRoot(config) {
-    validateKeycloakAdminConfig(config);
-    return {
-      module: _KeycloakAdminModule,
-      global: true,
-      imports: [
-        import_http_client2.HttpModule.forRoot({
-          baseURL: config.baseUrl,
-          timeout: 5e3
-        }, {
-          logging: {
-            enabled: true,
-            includeBody: true,
-            context: "KeycloakAdminHttpClient",
-            environments: [
-              "development",
-              "test"
-            ]
-          }
-        })
-      ],
-      providers: [
-        {
-          provide: KEYCLOAK_ADMIN_CONFIG,
-          useValue: config
-        },
-        {
-          provide: KEYCLOAK_ADMIN_CLIENT,
-          useClass: KeycloakAdminClient
-        },
-        {
-          provide: KEYCLOAK_ADMIN_PROVIDER,
-          useExisting: KEYCLOAK_ADMIN_CLIENT
-        }
-      ],
-      exports: [
-        KEYCLOAK_ADMIN_CLIENT,
-        KEYCLOAK_ADMIN_PROVIDER,
-        KEYCLOAK_ADMIN_CONFIG
-      ]
-    };
-  }
-};
-__name(_KeycloakAdminModule, "KeycloakAdminModule");
-var KeycloakAdminModule = _KeycloakAdminModule;
-KeycloakAdminModule = _ts_decorate2([
-  (0, import_common2.Module)({})
-], KeycloakAdminModule);
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  KEYCLOAK_ADMIN_CLIENT,
-  KEYCLOAK_ADMIN_CONFIG,
-  KEYCLOAK_ADMIN_PROVIDER,
-  KeycloakAdminClient,
+export {
+  KEYCLOAK_ADMIN_ERROR_CODE,
+  KEYCLOAK_ADMIN_TOKEN_RENEWAL_SKEW_MS,
   KeycloakAdminError,
-  KeycloakAdminModule,
-  validateKeycloakAdminConfig
-});
+  buildKeycloakAdminEndpoints,
+  createKeycloakAdminClient,
+  isKeycloakAdminError,
+  keycloakAdminConfigSchema,
+  parseKeycloakAdminConfig
+};